5 ms·
Everyone, please stop SMS as a 2FA. It's not. Cell carriers are not secure by any stretch of the imagination. Your entire identity should not be in the hands of
by exabrial 6y ago
Everyone, please stop SMS as a 2FA. It's not. Cell carriers are not secure by any stretch of the imagination. Your entire identity should not be in the hands of these companies.
At this point there needs to be legislation or lawsuits, as it's out of hand. Apple is the worst offender, you can't create an account without it.
- lotsofpulp 6y agoEven the federal government uses it for things like IRS and Social Security login.
- cookiengineer 6y agoAnd there they are, lurking around with an OsmoComBB device and waiting to strike. SS7 is such a bad concept on every level. Everyone can listen, everyone can intercept, everyone can track. Back in the days I lost one of my domains because of 2FA via SMS, and I've learned my lesson. Sadly lots of companies don't understand that broadcasting a secure login token via an unencrypted transport protocol to the world is a bad idea.
- zrm 6y agoThis exactly. The title here is Security and Privacy Risks of Number Recycling, but number recycling isn't the problem. It's like pointing the finger at IP address recycling. That's not it. It's that people are using SMS as 2FA when they ought not to be.